GitHub Advisoryadvisory · npm

GHSA-g9jw-92q7-g7fj [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

HIGH Published 2026-06-18 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-44691
Ecosystem
npm
Packages
@theia/debug, @theia/task, @theia/workspace
Severity
High
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-829
Reviewed
2026-06-19

Affected packages

• npm @theia/debug: < 1.69.0 → fixed in 1.69.0 • npm @theia/task: < 1.69.0 → fixed in 1.69.0 • npm @theia/workspace: < 1.69.0 → fixed in 1.69.0

Description

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.

Related

Alias · CVE (1)

  • CVE-2026-44691 In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References